Function sanitizeFileName

src/bridge/inboundAttachments.ts:55–58

* Strip path components and keep only filename-safe chars. file_name comes * from the network (web composer), so treat it as untrusted even though the * composer controls it.

(name: string)

 * composer controls it.
 */
function sanitizeFileName(name: string): string {
  const base = basename(name).replace(/[^a-zA-Z0-9._-]/g, '_')
  return base || 'attachment'
}

function uploadsDir(): string {
  return join(getClaudeConfigHomeDir(), 'uploads', getSessionId())